topic Re: Any options for encrypting replication data? in Array Performance and Data Protection

Any options for encrypting replication data?

Chris Wilkins_1 — Wed, 10 Apr 2013 01:20:50 GMT

I am interested in encrypting the replication data in order to protect it in transit. Anyone have ideas for accomplishing this?

Re: Any options for encrypting replication data?

ajay59 — Wed, 10 Apr 2013 06:09:50 GMT

Hi Chris,

VPN encryption seems to be a common solution for protecting replication traffic.

Re: Any options for encrypting replication data?

Chris Wilkins_1 — Wed, 10 Apr 2013 11:46:02 GMT

We are planning to create a VPN tunnel between our primary and secondary Nimble units. I was hoping to hear the approach taken by other Nimble customers.

Re: Any options for encrypting replication data?

franku72 — Wed, 10 Apr 2013 18:03:14 GMT

Hi Chris,

We use OpenVPN for tunneling: It's fast, free and relatively easy to setup. Currently we are also using dark fiber to a remote location.

You could probably also use VLAN's if your data stays locally ?

Regards,

Frank Uittenbosch

Re: Any options for encrypting replication data?

Mon, 15 Apr 2013 14:35:45 GMT

We are using an IPsec vpn tunnel between our Palo Alto Firewalls and replicating traffic across it.

Re: Any options for encrypting replication data?

benwatson87 — Tue, 23 Apr 2013 15:26:56 GMT

Our customers almost all use external [to the array] VPN-encryption, which I'd say is probably the best/easiest way to do this if required. Encrypting packets for replication is a fairly arduous process, and although some platforms offer this I'd rather my storage array handles I/O particularly when there are viable alternatives.

However, once the initial replication is complete (perhaps using a local replica for the bulk transfer of data), is there actually any need to encrypt replicated deltas? Thinking about it, we're replicating compressed, changed blocks only from a custom-designed/implemented filesystem. One for the Nimble engineering team perhaps...